Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Instead of implementing breakpoints with INT 3, which relies on the OS's debug event support, our debugger injected new basic blocks into the program to pause the target, perform I/O with it, and redirect it to other code paths.

You should have no trouble looking up what a "trampoline" is, but I'm abusing the term a bit.



So you made a debugger below the OS by instrumenting the target program to do debuggery things? That's pretty cool. But at what granularity did you inject the code? Presumably not around every single instruction. But if it was just on demand wherever the user set a breakpoint, how would you implement stepping?


We didn't do stepping (at least, mine didn't); instead, we tended to do things like Detours, where we'd target a broad set of bblocks in the program and either log, or snapshot the process when they were hit.

There is a pattern for single-stepping using similar techniques: "user mode single stepping".

One thing to bear in mind: it was easy for us to do this in part because crashing the target program was not a big deal for us.


Thank you. That sounds really cool.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: